NSA DIRECTOR & CYBERCOM COMMANDER WANTS BUSINESS-GOVERNMENT-ACADEMIA PARTNERSHIP

FROM:  U.S. DEFENSE DEPARTMENT

Cybercom Chief: Partners Vital to Defending Infrastructure

By Army Sgt. 1st Class Tyrone C. Marshall Jr.

American Forces Press Service

WASHINGTON, June 25, 2014 – Building partnerships among the federal government, the private sector and academia is vital to bringing together capabilities in the defense of critical infrastructure, the commander of U.S. Cyber Command said yesterday.

Navy Adm. Michael S. Rogers, also director of the National Security Agency, shared his thoughts nearly 90 days after assuming command of Cybercom as he delivered the keynote address at the Armed Forces Communications and Electronics Association cyber symposium in Baltimore.

“One of my first takeaways is cyber is the ultimate team sport,” he said. “There is no one single organization that has all the answers. There is no one single technology that will solve all of our problems [and] meet all of our challenges. This is a mission set that does not know clearly defined lines.”

The Defense Department, traditionally likes to use geography as one way to align its responsibilities to define its problem sets, the admiral said.

“Our networks just flat-out don’t recognize geography, which is one reason why U.S. Cyber Command is a little different,” Rogers said. “It is organized as a global command focused on a particular mission set.”

Rogers noted that DOD provides capabilities to support civil authorities in a wide range of scenarios almost every day all over the country.
“So cyber is no different in that regard,” he said. “But it’s different in the sense that it’s just something new.”

Rogers cited a recent meeting with the secretary of homeland security and the FBI director as one of the things he finds himself spending “a lot of time” doing: creating partnerships and relationships that help the U.S. government apply its capabilities to support the broader civil sector.

Cyber legislation “remains a very important part of this journey,” Rogers said, because while voluntary information-sharing has shown some progress, “it just has not gotten us where we need to be.”

“And I believe we have to come up with some vehicle to help the private sector deal with its very valid concerns about liability,” he added. “If we can’t bring this all together on a real-time basis, it’s like we’re fighting with one hand tied behind our backs. And it’s a losing defensive proposition to me.”

Rogers said being in a defensive mode means an organization is always responding and is “always behind the power curve in general.”

“My argument would be it’s the offensive piece that tends to have the easier job,” he said. “The defensive piece is really the hard work where partnerships, in particular, become so critical for us.”

Rogers also said he thinks Cybercom should assist its civilian counterparts in understanding how the federal government is organized to provide them cyber support.

“We are working our way through those steps right now,” he said, “but our ability to create those partnerships is critical to the future.”

The admiral also said he believes at some point in his time as commander of Cybercom, the nation will see efforts from another nation-state, group or set of individuals designed to cause destructive cyber impacts against critical U.S. infrastructure.

“I believe that will happen in my service lifetime,” he added. “So one of my primary focuses is how do you generate the capacity to stop that?”
DOD is going to be only one part of the effort, the admiral said.

“In the end, it’s about that broader set of partnerships,” Rogers told the audience. “They're going to be the key to our success.”

NSA DIRECTOR ASKS INDUSTRY'S HELP IN GETTING AMERICAN PEOPLE TO UNDERSTAND THE FACTS

FROM:  U.S. DEFENSE DEPARTMENT 
Alexander Calls on Industry to Help Set Record Straight
By Nick Simeone
American Forces Press Service

WASHINGTON, Oct. 9, 2013 - The nation's top cyber commander called on industry today to "put the facts on the table" about the National Security Agency following leaks about the agency's surveillance programs, blaming inaccurate or sensational reporting for congressional failure to approve measures that he said are needed to protect the nation from a devastating cyberattack.

"We need the American people to understand the facts. And it's got to start with what we're actually doing -- not what we could be doing -- with the data," Army Gen. Keith B. Alexander, NSA director and commander of U.S. Cyber Command, told an industry conference in suburban Maryland. "Most of the reporting is, 'They could be doing 'A.' The facts are they're doing 'B.'"

Warning that he doesn't want to have to explain why he failed to prevent another 9/11, Alexander appealed to industry to help in light of the damaging leaks in June by former NSA contractor Edward Snowden.

Snowden has been charged in absentia with violating the Espionage Act and stealing government property for turning over secret documents to reporters detailing classified NSA programs, actions that Alexander has blamed for causing irreversible and significant damage to the security of the United States and its allies.

In the time since the leaks, Alexander said, the media have complicated matters through exaggerated or inaccurate reporting.

"Everything that comes out is almost sensationalized and inflamed by what it could be, not by what it is, and that singularly in my mind will impact our ability to get cyber legislation and defend the nation," he said. "And if you think about the numbers of disruptive attacks over the last year, and destructive attacks, and you plot that out statistically, what it says to me is it's getting worse, and that's going to grow."

Alexander pointed to a series of recent destructive cyberattacks around the world, including on Saudi Aramco, a Saudi oil company, where he said data in more than 30,000 systems was destroyed last year, as well as attacks against Qatar's Rasgas gas company and twin attacks in South Korea earlier this year.

"Then, look at what hit Wall Street over the last year: over 300 distributed denial-of-service attacks. How do we defend against those?"

Alexander called for laws that would encourage industry and government to share information about potential threats in real time. "This will become hugely important in the future," he said. We've got to have legislation that allows us to communicate back and forth."

To get there, the general said, the rhetoric on media leaks must change and the trust factor must be fixed, "because we're not going to move forward with all that hanging out there."

In the absence of congressional action, President Barack Obama has issued an executive order promoting increased sharing of information about cyber threats across government and industry. However, Alexander said, the nation's cyber defenses remain dependent on closer, real-time cooperation between the government and Internet service providers and the anti-virus community.

"Our team -- government, industry and allies -- have to be ready to act, and we're not," he said. "We're stuck because of where we are in the debate, so what you could do to help is get the facts. We need your help to inform the American people and Congress about what we're doing."

NSA AND U.S. CYBERSECURITY

From:  U.S. Department of Defense

FROM: U.S. DEPARTMENT OF DEFENSE
U.S. Should Lead Cybersecurity Efforts, NSA Director Says
By Amaani Lyle
American Forces Press Service

WASHINGTON, Oct. 4, 2012 - Analyzing and solving the challenge of cybersecurity is critical to the global economy, the National Security Agency director said during the U.S. Chamber of Commerce Cybersecurity Summit here today.

U.S. Army Gen. Keith Alexander, who also heads U.S. Cyber Command and the Central Security Service, discussed the costs and consequences of cybersecurity issues on commerce during his keynote address at the summit.

Well-known, seemingly invulnerable companies such as Symantec, L3, Sony, Google, Visa and even the U.S. Chamber of Commerce itself have been hacked, Alexander said, noting that even the military and government agencies have fallen prey to hackers.

"Either you know you've been hacked, or you've been hacked and you don't know you've been hacked," Alexander said. The greatest threats stem from theft of intellectual property, and disruptive attacks, Alexander said, citing examples since May 2007 that include attacks against Estonia, Georgia, Latvia and Lithuania.
"Distributed denial of service attacks ... are gaining in momentum, intensity and frequency," he said, emphasizing the urgency of defending the United States from attacks and exploitation.

Industry partnership with government agencies such as the Defense Department, Department of Homeland Security, and Federal Bureau of Investigation to counter threats will be a critical component of fortifying cybersecurity, Alexander said, noting that U.S. should develop the solution.

"Our country ... built this Internet and all the stuff that goes with it, and it is absolutely superb," Alexander said. "We're the nation that developed the Internet; we ought to be the first to secure it."

According to Alexander, last year, the average number of emails sent per day was 419,000 billion, or about 70 emails per person. Additionally, there were 4.7 billion Google searches per day and still billions of steadily increasing bytes of global traffic, the general explained.

From a commerce perspective, the growth of new major companies in less than a decade demonstrates the importance of protecting intellectual property and proprietary information, Alexander said. The general offered compelling examples of growth and how quickly it could have been stymied if privileged information had been compromised.

In 2002, he said, Amazon was worth $851 million, compared to $12.83 billion today. Apple, worth $5.7 billion in 2002, is now worth a staggering $148 billion today. Google, worth $3.1 billion in 2004, is now valued at $43 billion in 2012, he said. "The value ... is extraordinary," Alexander said, adding that the government depends on similar networks to defend the country.

"If we've all been hacked, that means that we can all be attacked, and if we can be attacked, we have a vulnerability that ... is critical to the operation of this country," the general said.

Education, training and a defensible architecture such as cloud computing, however, can help steel government networks from such vulnerabilities, Alexander explained. "The cloud ... has tremendous opportunities for a more defensible architecture," Alexander said. "So ... the Defense Department and the [intelligence] community moving to a thin, virtual client approach makes a lot of sense."

Alexander also noted the importance of military, government and industry developing a common view of cyberspace issues and their solutions. "We have to have that understanding, especially when you talk to your [chief executive officers] and others about the solutions that you're trying to put in there," he said.